Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 1 articles for you...
172
security advisorycriticalDoSUbuntu Netty Critical HTTP Injection DoS Vulnerabilities USN-8401-1
Several security issues were fixed in Netty.. ========================================================================== Ubuntu Security Notice USN-8401-1 June 08, 2026 netty vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: Several security issues were fixed in Netty. Software Description: - netty: event-driven asynchronous network application framework Details: It was discovered that Netty's HTTP proxy handler did not properly validate headers when constructing CONNECT requests. An attacker could possibly use this issue to inject arbitrary HTTP headers into CONNECT requests. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-42578) It was discovered that Netty's DNS codec did not properly enforce domain name constraints. An attacker could possibly use this issue to bypass domain name validation, or cause Netty to consume resources, leading to a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-42579) It was discovered that Netty did not correctly handle HTTP/1.0 requests containing both a Transfer-Encoding and Content-Length header. A remote attacker could possibly use this issue to perform HTTP request smuggling attacks. (CVE-2026-42581) Violeta Georgieva discovered that Netty incorrectly paired responses with requests when handling informational HTTP responses. A remote attacker could possibly use this issue to perform HTTP request smuggling attacks. (CVE-2026-42584) Violeta Georgieva discovered that Netty incorrectly parsed malformed Transfer-Encoding headers. A remote attacker could possibly use this issue to perform HTTP request smuggling attacks. (CVE-2026-42585) It was discovered thatNetty's Redis encoder did not validate CRLF characters. An attacker could possibly use this issue to inject arbitrary Redis commands. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-42586) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS libnetty-java 1:4.1.48-16ubuntu0.1~esm2 Available with Ubuntu Pro Ubuntu 24.04 LTS libnetty-java 1:4.1.48-9ubuntu0.1+esm3 Available with Ubuntu Pro Ubuntu 22.04 LTS libnetty-java 1:4.1.48-4+deb11u2ubuntu0.1+esm3 Available with Ubuntu Pro Ubuntu 20.04 LTS libnetty-java 1:4.1.45-1ubuntu0.1~esm6 Available with Ubuntu Pro Ubuntu 18.04 LTS libnetty-java 1:4.1.7-4ubuntu0.1+esm6 Available with Ubuntu Pro Ubuntu 16.04 LTS libnetty-java 1:4.0.34-1ubuntu0.1~esm4 Available with Ubuntu Pro Ubuntu 14.04 LTS libnetty-java 1:3.2.6.Final-2+deb8u2ubuntu0.1~esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8401-1 CVE-2026-42578, CVE-2026-42579, CVE-2026-42581, CVE-2026-42584, CVE-2026-42585, CVE-2026-42586 . Multiple critical issues fixed in Netty for Ubuntu affecting various LTS releases, including HTTP injection and DoS risks.. Ubuntu security, Netty fixes, HTTP smuggling. . Severity: Critical. LinuxSecurity.com Team
Jun 08, 2026
•Critical
Ubuntu
202
security advisoryDoSimportantopenSUSE 15.6 Python 3.11 Major Update Resolving 14 Security Flaws
An update that solves 15 vulnerabilities can now be installed.. # Security update for python311 Announcement ID: SUSE-SU-2026:1349-1 Release Date: 2026-04-15T13:36:10Z Rating: important References: * bsc#1252974 * bsc#1254400 * bsc#1254401 * bsc#1254997 * bsc#1257029 * bsc#1257031 * bsc#1257042 * bsc#1257046 * bsc#1257181 * bsc#1259240 * bsc#1259611 * bsc#1259734 * bsc#1259735 * bsc#1259989 * bsc#1260026 Cross-References: * CVE-2025-11468 * CVE-2025-12084 * CVE-2025-13462 * CVE-2025-13836 * CVE-2025-13837 * CVE-2025-15282 * CVE-2025-6075 * CVE-2026-0672 * CVE-2026-0865 * CVE-2026-1299 * CVE-2026-2297 * CVE-2026-3479 * CVE-2026-3644 * CVE-2026-4224 * CVE-2026-4519 CVSS scores: * CVE-2025-11468 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2025-11468 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2025-11468 ( NVD ): 5.7 CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2025-12084 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2025-12084 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L * CVE-2025-12084 ( NVD ): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2025-12084 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2025-13462 ( SUSE ): 2.0 CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2025-13462 ( SUSE ): 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N * CVE-2025-13462 ( NVD ): 2.0 CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2025-13836 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2025-13836 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2025-13836 ( NVD ): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2025-13836 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2025-13837 ( SUSE ): 2.1 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2025-13837 ( SUSE ): 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2025-13837 ( NVD ): 2.1 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2025-13837 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2025-15282 ( SUSE ): 5.9 CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2025-15282 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H * CVE-2025-15282 ( NVD ): 6.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2025-6075 ( SUSE ): 1.8 CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2025-6075 ( SUSE ): 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L * CVE-2025-6075 ( NVD): 1.8 CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2025-6075 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2026-0672 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2026-0672 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2026-0672 ( NVD ): 6.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-0865 ( SUSE ): 5.9 CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-0865 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H * CVE-2026-0865 ( NVD ): 5.9 CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-1299 ( SUSE ): 8.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2026-1299 ( SUSE ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N * CVE-2026-1299 ( NVD ): 6.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-2297 ( SUSE ): 5.7 CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2026-2297 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N * CVE-2026-2297 ( NVD ): 5.7 CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-3479 ( SUSE ): 2.0 CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-3479 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N * CVE-2026-3479 ( NVD ): 0.0 CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-3644 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-3644 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-3644 ( NVD ): 6.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-4224 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-4224 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2026-4224 ( NVD ): 6.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-4519 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N * CVE-2026-4519 ( SUSE ): 6.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N * CVE-2026-4519 ( NVD ): 7.0 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affected Products: * Basesystem Module 15-SP7 * openSUSE Leap 15.6 * Python 3 Module 15-SP7 * SUSE Linux Enterprise Desktop 15 SP7 * SUSE Linux Enterprise Real Time 15 SP7 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server 15 SP6 LTSS * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP7 An update that solves 15 vulnerabilities can now be installed. ## Description: This update for python311 fixes the following issues: * Updated to Python 3.11.15 * CVE-2025-6075: If the value passed to os.path.expandvars() is user- controlled aperformance degradation is possible when expanding environment variables (bsc#1252974). * CVE-2025-11468: header injection when folding a long comment in an email header containing exclusively unfoldable characters (bsc#1257029). * CVE-2025-12084: cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service (bsc#1254997). * CVE-2025-13462: incorrect parsing of TarInfo header when GNU long name and type AREGTYPE are combined (bsc#1259611). * CVE-2025-13836: When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length (bsc#1254400). * CVE-2025-13837: When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues (bsc#1254401). * CVE-2025-15282: user-controlled data URLs parsed may allow injecting headers (bsc#1257046). * CVE-2026-0672: HTTP header injection via user-controlled cookie values and parameters when using http.cookies.Morsel (bsc#1257031). * CVE-2026-0865: user-controlled header containing newlines can allow injecting HTTP headers (bsc#1257042). * CVE-2026-1299: header injection when an email is serialized due to improper newline quoting in `BytesGenerator` (bsc#1257181). * CVE-2026-2297: cpython: incorrectly handled hook in FileLoader can lead to validation bypass (bsc#1259240). * CVE-2026-3479: python: improper resource argument validation can allow path traversal (bsc#1259989). * CVE-2026-3644: incomplete control character validation in http.cookies (bsc#1259734). * CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735). * CVE-2026-4519: leading dashes in URLs are accepted by the `webbrowser.open()` API and allow for web browser command line option injection (bsc#1260026). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methodslike YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch SUSE-2026-1349=1 openSUSE-SLE-15.6-2026-1349=1 * Basesystem Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-1349=1 * Python 3 Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Python3-15-SP7-2026-1349=1 * SUSE Linux Enterprise Server 15 SP6 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-1349=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-1349=1 ## Package List: * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586) * python311-tk-debuginfo-3.11.15-150600.3.53.1 * python311-testsuite-3.11.15-150600.3.53.1 * python311-debugsource-3.11.15-150600.3.53.1 * python311-base-3.11.15-150600.3.53.1 * python311-curses-3.11.15-150600.3.53.1 * python311-tk-3.11.15-150600.3.53.1 * libpython3_11-1_0-3.11.15-150600.3.53.1 * python311-base-debuginfo-3.11.15-150600.3.53.1 * python311-core-debugsource-3.11.15-150600.3.53.1 * python311-testsuite-debuginfo-3.11.15-150600.3.53.1 * python311-doc-devhelp-3.11.15-150600.3.53.1 * python311-doc-3.11.15-150600.3.53.1 * python311-tools-3.11.15-150600.3.53.1 * python311-curses-debuginfo-3.11.15-150600.3.53.1 * python311-3.11.15-150600.3.53.1 * python311-debuginfo-3.11.15-150600.3.53.1 * python311-idle-3.11.15-150600.3.53.1 * python311-devel-3.11.15-150600.3.53.1 * libpython3_11-1_0-debuginfo-3.11.15-150600.3.53.1 * python311-dbm-debuginfo-3.11.15-150600.3.53.1 * python311-dbm-3.11.15-150600.3.53.1 * openSUSE Leap 15.6 (x86_64) * libpython3_11-1_0-32bit-debuginfo-3.11.15-150600.3.53.1 * python311-32bit-debuginfo-3.11.15-150600.3.53.1 * python311-32bit-3.11.15-150600.3.53.1 * python311-base-32bit-3.11.15-150600.3.53.1 * python311-base-32bit-debuginfo-3.11.15-150600.3.53.1 *libpython3_11-1_0-32bit-3.11.15-150600.3.53.1 * openSUSE Leap 15.6 (aarch64_ilp32) * python311-base-64bit-3.11.15-150600.3.53.1 * python311-64bit-3.11.15-150600.3.53.1 * python311-64bit-debuginfo-3.11.15-150600.3.53.1 * libpython3_11-1_0-64bit-3.11.15-150600.3.53.1 * libpython3_11-1_0-64bit-debuginfo-3.11.15-150600.3.53.1 * python311-base-64bit-debuginfo-3.11.15-150600.3.53.1 * Basesystem Module 15-SP7 (aarch64 ppc64le s390x x86_64) * libpython3_11-1_0-debuginfo-3.11.15-150600.3.53.1 * libpython3_11-1_0-3.11.15-150600.3.53.1 * python311-base-3.11.15-150600.3.53.1 * python311-base-debuginfo-3.11.15-150600.3.53.1 * python311-core-debugsource-3.11.15-150600.3.53.1 * Python 3 Module 15-SP7 (aarch64 ppc64le s390x x86_64) * python311-tk-debuginfo-3.11.15-150600.3.53.1 * python311-3.11.15-150600.3.53.1 * python311-debuginfo-3.11.15-150600.3.53.1 * python311-core-debugsource-3.11.15-150600.3.53.1 * python311-idle-3.11.15-150600.3.53.1 * python311-tk-3.11.15-150600.3.53.1 * python311-tools-3.11.15-150600.3.53.1 * python311-devel-3.11.15-150600.3.53.1 * python311-debugsource-3.11.15-150600.3.53.1 * python311-curses-3.11.15-150600.3.53.1 * python311-dbm-debuginfo-3.11.15-150600.3.53.1 * python311-dbm-3.11.15-150600.3.53.1 * python311-curses-debuginfo-3.11.15-150600.3.53.1 * SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64) * python311-tk-debuginfo-3.11.15-150600.3.53.1 * python311-3.11.15-150600.3.53.1 * python311-dbm-debuginfo-3.11.15-150600.3.53.1 * python311-debuginfo-3.11.15-150600.3.53.1 * python311-idle-3.11.15-150600.3.53.1 * python311-tk-3.11.15-150600.3.53.1 * python311-tools-3.11.15-150600.3.53.1 * python311-devel-3.11.15-150600.3.53.1 * libpython3_11-1_0-debuginfo-3.11.15-150600.3.53.1 * libpython3_11-1_0-3.11.15-150600.3.53.1 * python311-dbm-3.11.15-150600.3.53.1 * python311-debugsource-3.11.15-150600.3.53.1 *python311-base-3.11.15-150600.3.53.1 * python311-curses-3.11.15-150600.3.53.1 * python311-base-debuginfo-3.11.15-150600.3.53.1 * python311-core-debugsource-3.11.15-150600.3.53.1 * python311-curses-debuginfo-3.11.15-150600.3.53.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64) * python311-tk-debuginfo-3.11.15-150600.3.53.1 * python311-3.11.15-150600.3.53.1 * python311-dbm-debuginfo-3.11.15-150600.3.53.1 * python311-debuginfo-3.11.15-150600.3.53.1 * python311-idle-3.11.15-150600.3.53.1 * python311-tk-3.11.15-150600.3.53.1 * python311-tools-3.11.15-150600.3.53.1 * python311-devel-3.11.15-150600.3.53.1 * libpython3_11-1_0-debuginfo-3.11.15-150600.3.53.1 * libpython3_11-1_0-3.11.15-150600.3.53.1 * python311-dbm-3.11.15-150600.3.53.1 * python311-debugsource-3.11.15-150600.3.53.1 * python311-base-3.11.15-150600.3.53.1 * python311-curses-3.11.15-150600.3.53.1 * python311-base-debuginfo-3.11.15-150600.3.53.1 * python311-core-debugsource-3.11.15-150600.3.53.1 * python311-curses-debuginfo-3.11.15-150600.3.53.1 ## References: * https://www.suse.com/security/cve/CVE-2025-11468.html * https://www.suse.com/security/cve/CVE-2025-12084.html * https://www.suse.com/security/cve/CVE-2025-13462.html * https://www.suse.com/security/cve/CVE-2025-13836.html * https://www.suse.com/security/cve/CVE-2025-13837.html * https://www.suse.com/security/cve/CVE-2025-15282.html * https://www.suse.com/security/cve/CVE-2025-6075.html * https://www.suse.com/security/cve/CVE-2026-0672.html * https://www.suse.com/security/cve/CVE-2026-0865.html * https://www.suse.com/security/cve/CVE-2026-1299.html * https://www.suse.com/security/cve/CVE-2026-2297.html * https://www.suse.com/security/cve/CVE-2026-3479.html * https://www.suse.com/security/cve/CVE-2026-3644.html * https://www.suse.com/security/cve/CVE-2026-4224.html * https://www.suse.com/security/cve/CVE-2026-4519.html *https://bugzilla.suse.com/show_bug.cgi?id=1252974 * https://bugzilla.suse.com/show_bug.cgi?id=1254400 * https://bugzilla.suse.com/show_bug.cgi?id=1254401 * https://bugzilla.suse.com/show_bug.cgi?id=1254997 * https://bugzilla.suse.com/show_bug.cgi?id=1257029 * https://bugzilla.suse.com/show_bug.cgi?id=1257031 * https://bugzilla.suse.com/show_bug.cgi?id=1257042 * https://bugzilla.suse.com/show_bug.cgi?id=1257046 * https://bugzilla.suse.com/show_bug.cgi?id=1257181 * https://bugzilla.suse.com/show_bug.cgi?id=1259240 * https://bugzilla.suse.com/show_bug.cgi?id=1259611 * https://bugzilla.suse.com/show_bug.cgi?id=1259734 * https://bugzilla.suse.com/show_bug.cgi?id=1259735 * https://bugzilla.suse.com/show_bug.cgi?id=1259989 * https://bugzilla.suse.com/show_bug.cgi?id=1260026 . An important security advisory for openSUSE addressing 15 vulnerabilities in Python 3.11 with crucial updates.. Python security, openSUSE update, important vulnerabilities, HTTP injection, DoS attacks. . Severity: Important. LinuxSecurity.com Team
Apr 15, 2026
•Important
OpenSUSE
100
security advisorySuSEimportantSUSE python310 Important Security Update Alert - SUSE-SU-2026-0987-2
An update that solves six vulnerabilities can now be installed.. # Security update for python312 Announcement ID: SUSE-SU-2026:0644-1 Release Date: 2026-02-25T16:28:32Z Rating: important References: * bsc#1257029 * bsc#1257031 * bsc#1257041 * bsc#1257042 * bsc#1257044 * bsc#1257046 Cross-References: * CVE-2025-11468 * CVE-2025-15282 * CVE-2025-15366 * CVE-2025-15367 * CVE-2026-0672 * CVE-2026-0865 CVSS scores: * CVE-2025-11468 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2025-11468 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2025-11468 ( NVD ): 5.7 CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2025-15282 ( SUSE ): 5.9 CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2025-15282 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H * CVE-2025-15282 ( NVD ): 6.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2025-15366 ( SUSE ): 6.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2025-15366 ( SUSE ): 6.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H * CVE-2025-15366 ( NVD ): 5.9 CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2025-15367 ( SUSE ): 6.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2025-15367 ( SUSE ): 6.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H * CVE-2025-15367 ( NVD ): 5.9 CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X *CVE-2026-0672 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2026-0672 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2026-0672 ( NVD ): 6.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-0865 ( SUSE ): 5.9 CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-0865 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H * CVE-2026-0865 ( NVD ): 5.9 CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affected Products: * openSUSE Leap 15.6 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server 15 SP6 LTSS * SUSE Linux Enterprise Server for SAP Applications 15 SP6 An update that solves six vulnerabilities can now be installed. ## Description: This update for python312 fixes the following issues: * CVE-2025-11468: header injection when folding a long comment in an email header containing exclusively unfoldable characters (bsc#1257029). * CVE-2026-0672: HTTP header injection via user-controlled cookie values and parameters when using http.cookies.Morsel (bsc#1257031). * CVE-2026-0865: user-controlled header containing newlines can allow injecting HTTP headers (bsc#1257042). * CVE-2025-15366: user-controlled command can allow additional commands injected using newlines (bsc#1257044). * CVE-2025-15282: user-controlled data URLs parsed may allow injecting headers (bsc#1257046). * CVE-2025-15367: control characters may allow the injection of additional commands (bsc#1257041). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server 15 SP6 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-644=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-644=1 * openSUSE Leap 15.6 zypper in -t patch SUSE-2026-644=1 openSUSE-SLE-15.6-2026-644=1 ## Package List: * SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64) * libpython3_12-1_0-debuginfo-3.12.12-150600.3.43.1 * python312-3.12.12-150600.3.43.1 * python312-debuginfo-3.12.12-150600.3.43.1 * python312-curses-debuginfo-3.12.12-150600.3.43.1 * python312-debugsource-3.12.12-150600.3.43.1 * python312-tools-3.12.12-150600.3.43.1 * python312-dbm-debuginfo-3.12.12-150600.3.43.1 * python312-tk-3.12.12-150600.3.43.1 * python312-base-debuginfo-3.12.12-150600.3.43.1 * python312-core-debugsource-3.12.12-150600.3.43.1 * python312-curses-3.12.12-150600.3.43.1 * python312-dbm-3.12.12-150600.3.43.1 * python312-base-3.12.12-150600.3.43.1 * python312-idle-3.12.12-150600.3.43.1 * python312-tk-debuginfo-3.12.12-150600.3.43.1 * libpython3_12-1_0-3.12.12-150600.3.43.1 * python312-devel-3.12.12-150600.3.43.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64) * libpython3_12-1_0-debuginfo-3.12.12-150600.3.43.1 * python312-3.12.12-150600.3.43.1 * python312-debuginfo-3.12.12-150600.3.43.1 * python312-curses-debuginfo-3.12.12-150600.3.43.1 * python312-debugsource-3.12.12-150600.3.43.1 * python312-tools-3.12.12-150600.3.43.1 * python312-dbm-debuginfo-3.12.12-150600.3.43.1 * python312-tk-3.12.12-150600.3.43.1 * python312-base-debuginfo-3.12.12-150600.3.43.1 * python312-core-debugsource-3.12.12-150600.3.43.1 * python312-curses-3.12.12-150600.3.43.1 * python312-dbm-3.12.12-150600.3.43.1 * python312-base-3.12.12-150600.3.43.1 * python312-idle-3.12.12-150600.3.43.1 * python312-tk-debuginfo-3.12.12-150600.3.43.1 *libpython3_12-1_0-3.12.12-150600.3.43.1 * python312-devel-3.12.12-150600.3.43.1 * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586) * libpython3_12-1_0-debuginfo-3.12.12-150600.3.43.1 * python312-curses-debuginfo-3.12.12-150600.3.43.1 * python312-core-debugsource-3.12.12-150600.3.43.1 * python312-curses-3.12.12-150600.3.43.1 * python312-idle-3.12.12-150600.3.43.1 * python312-tk-debuginfo-3.12.12-150600.3.43.1 * python312-doc-3.12.12-150600.3.43.1 * python312-debugsource-3.12.12-150600.3.43.1 * python312-debuginfo-3.12.12-150600.3.43.1 * python312-dbm-debuginfo-3.12.12-150600.3.43.1 * python312-tk-3.12.12-150600.3.43.1 * python312-testsuite-debuginfo-3.12.12-150600.3.43.1 * python312-base-debuginfo-3.12.12-150600.3.43.1 * libpython3_12-1_0-3.12.12-150600.3.43.1 * python312-testsuite-3.12.12-150600.3.43.1 * python312-3.12.12-150600.3.43.1 * python312-tools-3.12.12-150600.3.43.1 * python312-doc-devhelp-3.12.12-150600.3.43.1 * python312-dbm-3.12.12-150600.3.43.1 * python312-base-3.12.12-150600.3.43.1 * python312-devel-3.12.12-150600.3.43.1 * openSUSE Leap 15.6 (x86_64) * python312-base-32bit-debuginfo-3.12.12-150600.3.43.1 * libpython3_12-1_0-32bit-3.12.12-150600.3.43.1 * python312-32bit-3.12.12-150600.3.43.1 * libpython3_12-1_0-32bit-debuginfo-3.12.12-150600.3.43.1 * python312-base-32bit-3.12.12-150600.3.43.1 * python312-32bit-debuginfo-3.12.12-150600.3.43.1 * openSUSE Leap 15.6 (aarch64_ilp32) * python312-64bit-debuginfo-3.12.12-150600.3.43.1 * libpython3_12-1_0-64bit-3.12.12-150600.3.43.1 * libpython3_12-1_0-64bit-debuginfo-3.12.12-150600.3.43.1 * python312-base-64bit-3.12.12-150600.3.43.1 * python312-64bit-3.12.12-150600.3.43.1 * python312-base-64bit-debuginfo-3.12.12-150600.3.43.1 ## References: * https://www.suse.com/security/cve/CVE-2025-11468.html * https://www.suse.com/security/cve/CVE-2025-15282.html *https://www.suse.com/security/cve/CVE-2025-15366.html * https://www.suse.com/security/cve/CVE-2025-15367.html * https://www.suse.com/security/cve/CVE-2026-0672.html * https://www.suse.com/security/cve/CVE-2026-0865.html * https://bugzilla.suse.com/show_bug.cgi?id=1257029 * https://bugzilla.suse.com/show_bug.cgi?id=1257031 * https://bugzilla.suse.com/show_bug.cgi?id=1257041 * https://bugzilla.suse.com/show_bug.cgi?id=1257042 * https://bugzilla.suse.com/show_bug.cgi?id=1257044 * https://bugzilla.suse.com/show_bug.cgi?id=1257046 . SUSE update addresses important security issues in python312, affecting multiple systems with potential injections.. SUSE python312 security issues important updates header injection. . Severity: Important. LinuxSecurity.com Team
Feb 26, 2026
•Important
SuSE
100
security advisorybuffer overflowSuSESUSE 16.0 libbrowser Major Web Insertion Buffer Overflow 2027-20340-4
An update that solves two vulnerabilities can now be installed.. # Security update for libsoup Announcement ID: SUSE-SU-2026:20339-1 Release Date: 2026-02-06T11:13:48Z Rating: important References: * bsc#1257440 * bsc#1257598 Cross-References: * CVE-2026-1536 * CVE-2026-1761 CVSS scores: * CVE-2026-1536 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N * CVE-2026-1536 ( SUSE ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N * CVE-2026-1536 ( NVD ): 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N * CVE-2026-1761 ( SUSE ): 9.2 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-1761 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2026-1761 ( NVD ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L Affected Products: * SUSE Linux Enterprise Server 16.0 * SUSE Linux Enterprise Server for SAP Applications 16.0 An update that solves two vulnerabilities can now be installed. ## Description: This update for libsoup fixes the following issues: * CVE-2026-1536: HTTP header injection or response splitting via CRLF injection in the Content-Disposition header (bsc#1257440). * CVE-2026-1761: incorrect length calculation when parsing of multipart HTTP responses can lead to a stack-based buffer overflow (bsc#1257598). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server 16.0 zypper in -t patch SUSE-SLES-16.0-250=1 * SUSE Linux Enterprise Server for SAP Applications 16.0 zypper in -t patch SUSE-SLES-16.0-250=1 ## Package List: * SUSE Linux Enterprise Server 16.0 (aarch64 ppc64le s390x x86_64) * typelib-1_0-Soup-3_0-3.6.5-160000.4.1 * libsoup-devel-3.6.5-160000.4.1 * libsoup-debugsource-3.6.5-160000.4.1 * libsoup-3_0-0-debuginfo-3.6.5-160000.4.1 *libsoup-3_0-0-3.6.5-160000.4.1 * SUSE Linux Enterprise Server 16.0 (noarch) * libsoup-lang-3.6.5-160000.4.1 * SUSE Linux Enterprise Server for SAP Applications 16.0 (ppc64le x86_64) * typelib-1_0-Soup-3_0-3.6.5-160000.4.1 * libsoup-devel-3.6.5-160000.4.1 * libsoup-debugsource-3.6.5-160000.4.1 * libsoup-3_0-0-debuginfo-3.6.5-160000.4.1 * libsoup-3_0-0-3.6.5-160000.4.1 * SUSE Linux Enterprise Server for SAP Applications 16.0 (noarch) * libsoup-lang-3.6.5-160000.4.1 ## References: * https://www.suse.com/security/cve/CVE-2026-1536.html * https://www.suse.com/security/cve/CVE-2026-1761.html * https://bugzilla.suse.com/show_bug.cgi?id=1257440 * https://bugzilla.suse.com/show_bug.cgi?id=1257598 . Update for libsoup addresses two important vulnerabilities that can lead to significant security threats in SUSE systems.. libsoup security update, SUSE vulnerabilities, buffer overflow threat, HTTP injection fix. . Severity: Important. LinuxSecurity.com Team
Feb 16, 2026
•Important
SuSE
202
security advisorybuffer overflowimportantFedora Core 36 libsoup Significant HTTP Injection Flaw 2027-28389-5
An update that solves 2 vulnerabilities and has 2 bug fixes can now be installed.. openSUSE security update: security update for libsoup ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20186-1 Rating: important References: * bsc#1257440 * bsc#1257598 Cross-References: * CVE-2026-1536 * CVE-2026-1761 CVSS scores: * CVE-2026-1536 ( SUSE ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N * CVE-2026-1536 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N * CVE-2026-1761 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2026-1761 ( SUSE ): 9.2 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Affected Products: openSUSE Leap 16.0 ------------------------------------------------------------- An update that solves 2 vulnerabilities and has 2 bug fixes can now be installed. Description: This update for libsoup fixes the following issues: - CVE-2026-1536: HTTP header injection or response splitting via CRLF injection in the Content-Disposition header (bsc#1257440). - CVE-2026-1761: incorrect length calculation when parsing of multipart HTTP responses can lead to a stack-based buffer overflow (bsc#1257598). Patch instructions: To install this openSUSE security update use the suse recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 16.0 zypper in -t patch openSUSE-Leap-16.0-250=1 Package List: - openSUSE Leap 16.0: libsoup-3_0-0-3.6.5-160000.4.1 libsoup-devel-3.6.5-160000.4.1 libsoup-lang-3.6.5-160000.4.1 typelib-1_0-Soup-3_0-3.6.5-160000.4.1 References: * https://www.suse.com/security/cve/CVE-2026-1536.html * https://www.suse.com/security/cve/CVE-2026-1761.html . Update for openSUSE fixes important issues in libsoup, addressing HTTP header injection and buffer overflow risks.. openSUSE libsoup update security importantvulnerabilities. . Severity: Important. LinuxSecurity.com Team
Feb 11, 2026
•Important
OpenSUSE
100
security advisorybuffer overflowSuSESUSE libsoup Important Stack Overflow HTTP Injection Advisory 2026-20238-1
An update that solves two vulnerabilities can now be installed.. # Security update for libsoup Announcement ID: SUSE-SU-2026:20238-1 Release Date: 2026-02-06T11:13:36Z Rating: important References: * bsc#1257440 * bsc#1257598 Cross-References: * CVE-2026-1536 * CVE-2026-1761 CVSS scores: * CVE-2026-1536 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N * CVE-2026-1536 ( SUSE ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N * CVE-2026-1536 ( NVD ): 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N * CVE-2026-1761 ( SUSE ): 9.2 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-1761 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2026-1761 ( NVD ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L Affected Products: * SUSE Linux Micro 6.2 An update that solves two vulnerabilities can now be installed. ## Description: This update for libsoup fixes the following issues: * CVE-2026-1536: HTTP header injection or response splitting via CRLF injection in the Content-Disposition header (bsc#1257440). * CVE-2026-1761: incorrect length calculation when parsing of multipart HTTP responses can lead to a stack-based buffer overflow (bsc#1257598). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Micro 6.2 zypper in -t patch SUSE-SL-Micro-6.2-250=1 ## Package List: * SUSE Linux Micro 6.2 (aarch64 ppc64le s390x x86_64) * libsoup-debugsource-3.6.5-160000.4.1 * libsoup-3_0-0-debuginfo-3.6.5-160000.4.1 * libsoup-3_0-0-3.6.5-160000.4.1 ## References: * https://www.suse.com/security/cve/CVE-2026-1536.html * https://www.suse.com/security/cve/CVE-2026-1761.html * https://bugzilla.suse.com/show_bug.cgi?id=1257440 * https://bugzilla.suse.com/show_bug.cgi?id=1257598 . Update forlibsoup fixes critical issues in SUSE Linux Micro including HTTP header attacks and buffer overflows.. libsoup security update, SUSE critical patch, HTTP injection threat, buffer overflow patch. . Severity: Important. LinuxSecurity.com Team
Feb 11, 2026
•Important
SuSE
100
security advisorySuSEimportantopenSUSE 15.5 Busybox Important HTTP Injection CVE-2025-46394
An update that solves two vulnerabilities and has three security fixes can now be installed.. # Security update for busybox Announcement ID: SUSE-SU-2026:0236-1 Release Date: 2026-01-22T12:25:56Z Rating: important References: * bsc#1236670 * bsc#1241661 * bsc#1247779 * bsc#1249237 * bsc#1253245 Cross-References: * CVE-2025-46394 * CVE-2025-60876 CVSS scores: * CVE-2025-46394 ( SUSE ): 5.9 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N * CVE-2025-46394 ( SUSE ): 6.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N * CVE-2025-46394 ( NVD ): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N * CVE-2025-46394 ( NVD ): 3.2 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N * CVE-2025-60876 ( SUSE ): 8.8 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:N * CVE-2025-60876 ( SUSE ): 8.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N * CVE-2025-60876 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Affected Products: * openSUSE Leap 15.5 * openSUSE Leap 15.6 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP5 LTSS * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server 15 SP6 LTSS * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 An update that solves two vulnerabilities and has three security fixes can now be installed. ## Description: This update for busybox fixes the following issues: This update for busybox fixes the following issues: Security issues: * CVE-2025-46394: Fixed tar hidden files via escape sequence (CVE-2025-46394, bsc#1241661) * CVE-2025-60876: Fixed HTTP request header injection in wget (CVE-2025-60876, bsc#1253245) Other issues: * Set CONFIG_FIRST_SYSTEM_ID to 201 to avoidconfclict (bsc#1236670) * Fixed unshare -mrpf sh core dump on ppc64le (bsc#1249237) * Fixed adduser inside containers on an SELinux host (bsc#1247779) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2026-236=1 * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2026-236=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-236=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-236=1 * SUSE Linux Enterprise Server 15 SP5 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-236=1 * SUSE Linux Enterprise Server 15 SP6 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-236=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-236=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-236=1 ## Package List: * openSUSE Leap 15.5 (noarch) * busybox-policycoreutils-1.37.0-150500.7.9.1 * busybox-tar-1.37.0-150500.7.9.1 * busybox-udhcpc-1.37.0-150500.7.9.1 * busybox-selinux-tools-1.37.0-150500.7.9.1 * busybox-findutils-1.37.0-150500.7.9.1 * busybox-time-1.37.0-150500.7.9.1 * busybox-netcat-1.37.0-150500.7.9.1 * busybox-ncurses-utils-1.37.0-150500.7.9.1 * busybox-ed-1.37.0-150500.7.9.1 * busybox-adduser-1.37.0-150500.7.9.1 * busybox-links-1.37.0-150500.7.9.1 * busybox-traceroute-1.37.0-150500.7.9.1 * busybox-misc-1.37.0-150500.7.9.1 * busybox-net-tools-1.37.0-150500.7.9.1 * busybox-unzip-1.37.0-150500.7.9.1 * busybox-util-linux-1.37.0-150500.7.9.1 * busybox-iproute2-1.37.0-150500.7.9.1 * busybox-sharutils-1.37.0-150500.7.9.1 * busybox-whois-1.37.0-150500.7.9.1 * busybox-tftp-1.37.0-150500.7.9.1 * busybox-kbd-1.37.0-150500.7.9.1 * busybox-cpio-1.37.0-150500.7.9.1 * busybox-grep-1.37.0-150500.7.9.1 * busybox-patch-1.37.0-150500.7.9.1 * busybox-bind-utils-1.37.0-150500.7.9.1 * busybox-vlan-1.37.0-150500.7.9.1 * busybox-iputils-1.37.0-150500.7.9.1 * busybox-sendmail-1.37.0-150500.7.9.1 * busybox-attr-1.37.0-150500.7.9.1 * busybox-xz-1.37.0-150500.7.9.1 * busybox-gzip-1.37.0-150500.7.9.1 * busybox-hostname-1.37.0-150500.7.9.1 * busybox-kmod-1.37.0-150500.7.9.1 * busybox-sed-1.37.0-150500.7.9.1 * busybox-psmisc-1.37.0-150500.7.9.1 * busybox-dos2unix-1.37.0-150500.7.9.1 * busybox-sha3sum-1.37.0-150500.7.9.1 * busybox-which-1.37.0-150500.7.9.1 * busybox-gawk-1.37.0-150500.7.9.1 * busybox-tunctl-1.37.0-150500.7.9.1 * busybox-diffutils-1.37.0-150500.7.9.1 * busybox-telnet-1.37.0-150500.7.9.1 * busybox-sysvinit-tools-1.37.0-150500.7.9.1 * busybox-hexedit-1.37.0-150500.7.9.1 * busybox-syslogd-1.37.0-150500.7.9.1 * busybox-procps-1.37.0-150500.7.9.1 * busybox-sh-1.37.0-150500.7.9.1 * busybox-coreutils-1.37.0-150500.7.9.1 * busybox-vi-1.37.0-150500.7.9.1 * busybox-bzip2-1.37.0-150500.7.9.1 * busybox-less-1.37.0-150500.7.9.1 * busybox-man-1.37.0-150500.7.9.1 * busybox-bc-1.37.0-150500.7.9.1 * busybox-wget-1.37.0-150500.7.9.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * busybox-static-1.37.0-150500.10.14.1 * busybox-testsuite-1.37.0-150500.10.14.1 * busybox-1.37.0-150500.10.14.1 * busybox-static-debuginfo-1.37.0-150500.10.14.1 * busybox-debuginfo-1.37.0-150500.10.14.1 * busybox-debugsource-1.37.0-150500.10.14.1 * openSUSE Leap 15.5 (aarch64 x86_64 i586) * busybox-warewulf3-1.37.0-150500.10.14.1 * busybox-warewulf3-debuginfo-1.37.0-150500.10.14.1 * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64) *busybox-1.37.0-150500.10.14.1 * busybox-static-1.37.0-150500.10.14.1 * busybox-testsuite-1.37.0-150500.10.14.1 * openSUSE Leap 15.6 (noarch) * busybox-policycoreutils-1.37.0-150500.7.9.1 * busybox-tar-1.37.0-150500.7.9.1 * busybox-udhcpc-1.37.0-150500.7.9.1 * busybox-selinux-tools-1.37.0-150500.7.9.1 * busybox-findutils-1.37.0-150500.7.9.1 * busybox-time-1.37.0-150500.7.9.1 * busybox-netcat-1.37.0-150500.7.9.1 * busybox-ncurses-utils-1.37.0-150500.7.9.1 * busybox-ed-1.37.0-150500.7.9.1 * busybox-adduser-1.37.0-150500.7.9.1 * busybox-links-1.37.0-150500.7.9.1 * busybox-traceroute-1.37.0-150500.7.9.1 * busybox-misc-1.37.0-150500.7.9.1 * busybox-net-tools-1.37.0-150500.7.9.1 * busybox-unzip-1.37.0-150500.7.9.1 * busybox-util-linux-1.37.0-150500.7.9.1 * busybox-iproute2-1.37.0-150500.7.9.1 * busybox-sharutils-1.37.0-150500.7.9.1 * busybox-whois-1.37.0-150500.7.9.1 * busybox-tftp-1.37.0-150500.7.9.1 * busybox-kbd-1.37.0-150500.7.9.1 * busybox-cpio-1.37.0-150500.7.9.1 * busybox-grep-1.37.0-150500.7.9.1 * busybox-patch-1.37.0-150500.7.9.1 * busybox-bind-utils-1.37.0-150500.7.9.1 * busybox-vlan-1.37.0-150500.7.9.1 * busybox-iputils-1.37.0-150500.7.9.1 * busybox-sendmail-1.37.0-150500.7.9.1 * busybox-attr-1.37.0-150500.7.9.1 * busybox-xz-1.37.0-150500.7.9.1 * busybox-gzip-1.37.0-150500.7.9.1 * busybox-hostname-1.37.0-150500.7.9.1 * busybox-kmod-1.37.0-150500.7.9.1 * busybox-sed-1.37.0-150500.7.9.1 * busybox-psmisc-1.37.0-150500.7.9.1 * busybox-dos2unix-1.37.0-150500.7.9.1 * busybox-sha3sum-1.37.0-150500.7.9.1 * busybox-which-1.37.0-150500.7.9.1 * busybox-gawk-1.37.0-150500.7.9.1 * busybox-tunctl-1.37.0-150500.7.9.1 * busybox-diffutils-1.37.0-150500.7.9.1 * busybox-telnet-1.37.0-150500.7.9.1 * busybox-sysvinit-tools-1.37.0-150500.7.9.1 * busybox-hexedit-1.37.0-150500.7.9.1 * busybox-syslogd-1.37.0-150500.7.9.1 *busybox-procps-1.37.0-150500.7.9.1 * busybox-sh-1.37.0-150500.7.9.1 * busybox-coreutils-1.37.0-150500.7.9.1 * busybox-vi-1.37.0-150500.7.9.1 * busybox-bzip2-1.37.0-150500.7.9.1 * busybox-less-1.37.0-150500.7.9.1 * busybox-man-1.37.0-150500.7.9.1 * busybox-bc-1.37.0-150500.7.9.1 * busybox-wget-1.37.0-150500.7.9.1 * openSUSE Leap 15.6 (aarch64 x86_64) * busybox-warewulf3-1.37.0-150500.10.14.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (aarch64 x86_64) * busybox-1.37.0-150500.10.14.1 * busybox-static-1.37.0-150500.10.14.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (aarch64 x86_64) * busybox-1.37.0-150500.10.14.1 * busybox-static-1.37.0-150500.10.14.1 * SUSE Linux Enterprise Server 15 SP5 LTSS (aarch64 ppc64le s390x x86_64) * busybox-1.37.0-150500.10.14.1 * busybox-static-1.37.0-150500.10.14.1 * SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64) * busybox-1.37.0-150500.10.14.1 * busybox-static-1.37.0-150500.10.14.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 (ppc64le x86_64) * busybox-1.37.0-150500.10.14.1 * busybox-static-1.37.0-150500.10.14.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64) * busybox-1.37.0-150500.10.14.1 * busybox-static-1.37.0-150500.10.14.1 ## References: * https://www.suse.com/security/cve/CVE-2025-46394.html * https://www.suse.com/security/cve/CVE-2025-60876.html * https://bugzilla.suse.com/show_bug.cgi?id=1236670 * https://bugzilla.suse.com/show_bug.cgi?id=1241661 * https://bugzilla.suse.com/show_bug.cgi?id=1247779 * https://bugzilla.suse.com/show_bug.cgi?id=1249237 * https://bugzilla.suse.com/show_bug.cgi?id=1253245 . Address critical updates for busybox on SUSE systems to mitigate security issues and enhance system integrity.. SUSE busybox update security important CVE fixes. . Severity: Important. LinuxSecurity.com Team
Jan 22, 2026
•Important
SuSE
100
security advisorymoderate issueopenSUSEopenSUSE Leap 15.x: 2024:0033-1 Moderate: HTTP Header Injection Fix
* bsc#1217684 Cross-References: * CVE-2023-49081 . # Security update for python-aiohttp Announcement ID: SUSE-SU-2024:0033-1 Rating: moderate References: * bsc#1217684 Cross-References: * CVE-2023-49081 CVSS scores: * CVE-2023-49081 ( SUSE ): 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2023-49081 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * Python 3 Module 15-SP5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves one vulnerability can now be installed. ## Description: This update for python-aiohttp fixes the following issues: * CVE-2023-49081: fixed an HTTP header injection via a crafted version (bsc#1217684). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-33=1 * Python 3 Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Python3-15-SP5-2024-33=1 * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-33=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * python311-aiohttp-3.8.5-150400.10.8.1 * python311-aiohttp-debuginfo-3.8.5-150400.10.8.1 * python-aiohttp-debugsource-3.8.5-150400.10.8.1 * Python 3 Module 15-SP5 (aarch64 ppc64le s390x x86_64) * python311-aiohttp-3.8.5-150400.10.8.1 * python311-aiohttp-debuginfo-3.8.5-150400.10.8.1 * python-aiohttp-debugsource-3.8.5-150400.10.8.1 * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * python311-aiohttp-3.8.5-150400.10.8.1 * python311-aiohttp-debuginfo-3.8.5-150400.10.8.1 * python-aiohttp-debugsource-3.8.5-150400.10.8.1 ## References: *https://www.suse.com/security/cve/CVE-2023-49081.html * https://bugzilla.suse.com/show_bug.cgi?id=1217684 . SUSE unveils a security update for python-aiohttp targeting a vulnerability in HTTP header injection classified as medium severity. openSUSE Security Update, Python Aiohttp Patch, HTTP Injection Fix. . LinuxSecurity.com Team
Jan 05, 2024
SuSE
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!